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into a script capable of contin uously performing the self-detection 
during execution th rough the method call sequence based on th * 
detection rules and th e self-detection routine- 
wherein the self-dete ction routine is composed of sentenc.es for 
storing parameters and return values and calling a detection engine, said 
sentences being inserted before and after the method call sentence when 
the method call sentence matches with contents described in the matching 
rule, and 

wherein the self-detection routine includes a rule-based detection 
engine for executing the relation rule related to a relevant matching rule 
when a method corresponding to the matching rule is called and detecting 
the presence of malicious behavior of the method call sequence, and 
methods for causing the parameters and return values of the method call 
sentence satisfying the matching rule to be stored into a buffer usable by 
the detection engine. 

3. (New) The method according to claim 1, further comprising selecting one 
rule as a higher level rule, representative of all relation rules in a set of 
relation rules. 



4. (New) The method according to claim 1 , further comprising upon satisfying 
the conditions of the condition phrases, generating an instance of a 
relation rule and thereafter checking at least one higher level rule. 

5. (New) The method according to claim 4, wherein a hig her level rule is a 
rule with a relevant rule included in its own condition expression. 



6. (New) The method according to claim 1 , further comprising loading 
matching rules and relation rules from a rule description file. 
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7. (New) The method according to claim 6. further comprising generating a 
corresponding method from each matching rule. 

8. (New) The method according to claim 6, further comprising generating a 
corresponding method from each relation rule. 

9. (New) The method according to claim 1, further comprising initializing 
each self-detection routine (malicious behavior detection routine) call 
sentence located before and after each of said method call sentences of 
an original script, prior to performing said continuous detection. 
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